A call comes into the help desk about a user account that is getting locked out repeatedly -- and this pilot fish is pretty sure he knows why it's happening.

"From experience we know that this is usually a smartphone that is trying to check email with an old password after the user has changed their domain password," says fish.

"The user assures us that she has changed the password on her iPhone and that they both match. Still, the user account is locking out every 15 minutes."

Fish and his cohorts investigate further, but nothing else seems to be a likely candidate for the lockout. He checks with the user to confirm one more time, and she's adamant: She only has the iPhone and her local computer checking email on that account.

But after a week of troubleshooting, upgrading and rebooting Exchange, the account continues to lock her out multiple times a day.

At this point, three separate on-staff support techs have looked at it and come up with nothing. But the outside consultant brought in to help with the Exchange upgrade hasn't given up.

The consultant manages to find a little more information about the failed attempts to access the email account: They're coming from a mobile device using the Outlook Web App, and with an IP address that's not on the company network.

"That IP address traces to a block belonging to AT&T," fish says. "We go back to the user and find that she has AT&T broadband service at her home.

"It's only then that she tells us, 'Oh yeah, I have an old Android phone at home that I use just as a backup.' Turns out that phone has an active sync account on it and has been attempting to check her corporate email account."

Sharky's only got one email address, so send me your true tale of IT life at sharky@computerworld.com. You'll snag a snazzy Shark shirt if I use it. Add your comments below, and read some great old tales in the Sharkives.

Get your daily dose of out-takes from the IT Theater of the Absurd delivered directly to your Inbox. Subscribe now to the Daily Shark Newsletter.